Top Risks

• proxy permission from anonymous free-webmail developer — all browser traffic can be routed through unknown servers.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Brand impersonation: TikTok, YouTube, Telegram named without verified relationship; anonymous developer.
• Free-webmail dev (aofnoyaofnoy99@gmail.com), no developer name, no verified publisher — no accountability.
• No CSP declared (MV3 default applies, but combined with proxy and unverifiable dev raises overall risk).

Evidence

• proxy_permission manifest proxy declared — routes all browser traffic; critical capability for an anonymous free-webmail developer.
• free_webmail_developer store Developer email aofnoyaofnoy99@gmail.com; no developer name, no business website, no verified publisher.
• generic_google_privacy_policy store Privacy URL is Google account policy (479KB); scope_extension=false, data_collection=true, third_party_sharing=true — v3.5 D applies: +10.0.
• brand_impersonation store brand_mention.is_impersonation=true (TikTok, YouTube, Telegram); dev not verified owner — +2.0 Reputation.
• no_installs_no_rating store Install count empty, rating 0 — no social proof or trust signal available.
• description_in_russian manifest Manifest description in Russian Cyrillic; extension targets Russian-speaking users bypassing blocks on YouTube/Telegram/TikTok.
• no_cve_findings crx cve_findings_raw is empty; no known vulnerable JS libraries detected.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; 5 JS files scanned with no suspicious signals detected.

Permissions Breakdown

• proxy high Can redirect all browser traffic through attacker-controlled servers; extremely dangerous in untrusted hands.
• storage low Local storage access only; standard low-risk permission.

Pillar Scores

Bookkeeping